A more complete fix for #588

Author: rfm

ChangeLog

@@ -1,3 +1,13 @@
+2026-03-12 Richard Frith-Macdonald <rfm@gnu.org>
+
+	* Source/GSHTTPURLHandle.m:
+	* Source/NSURLProtocol.m:
+	Adjust to only add a Content-Length header for a zero length body when
+	the method of the request requires it (POST, PUT, PATCH).  In other
+	cases we should only add that header if the request has a body.
+	Issue pointed out by William Everett referencing RFC-9110 and saying
+	at least some web servers object to Content-length in GET requests.
+
 2026-03-10 Richard Frith-Macdonald <rfm@gnu.org>
 
 	* Source/GSSocketStream.m:

Source/GSHTTPURLHandle.m

@@ -447,7 +447,9 @@ - (void) bgdApply: (NSString*)basic
   NSMutableData		*buf;
   NSMutableData		*masked = nil;
   NSString		*version;
+  NSString		*method;
   NSMapEnumerator       enumerator;
+  NSUInteger		cl;
 
   RETAIN(self);
   if (debug)
@@ -501,15 +503,48 @@ - (void) bgdApply: (NSString*)basic
 	}
     }
 
-  /* Ensure we set the correct content length (may be zero)
+  cl = [wData length];
+
+  /* Use default method if none is set.
+   */
+  method = [request objectForKey: GSHTTPPropertyMethodKey];
+  if (method == nil)
+    {
+      if (cl > 0)
+	{
+	  method = @"POST";
+	}
+      else
+	{
+	  method = @"GET";
+	}
+    }
+  else if ([method isEqualToString: @"TRACE"])
+    {
+      /* A TRACE must not have a body
+       */
+      DESTROY(wData);
+      cl = 0;
+      NSMapRemove(wProperties, (void*)@"Content-Length");
+    }
+
+
+  /* When we have a non-empty body or a method which requires
+   * a body, we must specify the content length.
    */
   if ((id)NSMapGet(wProperties, (void*)@"Content-Length") == nil)
     {
-      NSMapInsert(wProperties, (void*)@"Content-Length",
-        (void*)[NSString stringWithFormat: @"%"PRIuPTR, [wData length]]);
+      if (cl > 0
+	|| [method isEqualToString: @"POST"]
+	|| [method isEqualToString: @"PUT"]
+	|| [method isEqualToString: @"PATCH"])
+	{
+	  NSMapInsert(wProperties, (void*)@"Content-Length",
+	    (void*)[NSString stringWithFormat: @"%"PRIuPTR, cl]);
+	}
     }
 
-  if ([wData length] > 0)
+  if (cl > 0)
     {
       /*
        * Assume content type if not specified.
@@ -536,7 +571,6 @@ - (void) bgdApply: (NSString*)basic
 	  NSString		*auth;
 	  GSHTTPAuthentication	*authentication;
 	  NSURLCredential	*cred;
-	  NSString		*method;
 	  NSString		*path;
 
 	  /* Create credential from user and password stored in the URL.
@@ -562,19 +596,6 @@ - (void) bgdApply: (NSString*)basic
 	      RELEASE(cred);
 	    }
 
-	  method = [request objectForKey: GSHTTPPropertyMethodKey];
-	  if (method == nil)
-	    {
-	      if ([wData length] > 0)
-		{
-		  method = @"POST";
-		}
-	      else
-		{
-		  method = @"GET";
-		}
-	    }
-
 	  path = [u _requestPath: [[request
 	    objectForKey: GSHTTPPropertyDigestURIOmitsQuery] boolValue]];
 

Source/NSURLProtocol.m

@@ -1782,6 +1782,7 @@ - (void) stream: (NSStream*)stream handleEvent: (NSStreamEvent)event
 	      NSDictionary	*d;
 	      NSEnumerator	*e;
 	      NSString		*s;
+	      NSString		*method;
 	      NSURL		*u;
 	      int		l;		
 	      NSData		*bytes;
@@ -1825,8 +1826,8 @@ - (void) stream: (NSStream*)stream handleEvent: (NSStreamEvent)event
 	       * method /path;params?query HTTP/version
 	       * where the params or query parts may be missing
 	       */
-	      [m appendData: [[this->request HTTPMethod]
-                dataUsingEncoding: NSASCIIStringEncoding]];
+	      method = [this->request HTTPMethod];
+	      [m appendData: [method dataUsingEncoding: NSASCIIStringEncoding]];
 	      [m appendBytes: " " length: 1];
 	      u = [this->request URL];
 	      s = [u _requestPath: 0];
@@ -1859,7 +1860,7 @@ - (void) stream: (NSStream*)stream handleEvent: (NSStreamEvent)event
 	       * we therefore won't end up adding a second header by
 	       * accident because the two header names differ in case.
 	       */
-	      if ([[this->request HTTPMethod] isEqual: @"POST"]
+	      if ([method isEqual: @"POST"]
 	        && [this->request valueForHTTPHeaderField:
 		  @"Content-Type"] == nil)
 		{
@@ -1907,8 +1908,16 @@ - (void) stream: (NSStream*)stream handleEvent: (NSStreamEvent)event
 		      [mm appendData: bytes];
 		    }
 		}
-	      if (l >= 0 && [this->request
-	        valueForHTTPHeaderField: @"Content-Length"] == nil)
+
+	      /* When we have a non-empty body or a method which requires
+	       * a body, we must specify the content length.
+	       */
+	      s = [this->request valueForHTTPHeaderField: @"Content-Length"];
+	      if (nil == s
+		&& (l > 0
+		  || [method isEqualToString: @"POST"]
+		  || [method isEqualToString: @"PUT"]
+		  || [method isEqualToString: @"PATCH"]))
 		{
                   s = [NSString stringWithFormat: @"Content-Length: %d\r\n", l];
                   bytes = [s dataUsingEncoding: NSASCIIStringEncoding];